macOS Sandbox: Add timezone subpath to profile.

This CL allows access to the entire timezone folder subpath, as macOS
has changed the layout of the timezone data on disk.

Bug: 818249
Change-Id: Ied9b81977e0453616b72e74da86d4d67c211785b
Reviewed-on: https://chromium-review.googlesource.com/969617Reviewed-by: Robert Sesek <rsesek@chromium.org>
Commit-Queue: Greg Kerr <kerrnel@chromium.org>
Cr-Commit-Position: refs/heads/master@{#544197}

services/service_manager/sandbox/mac/common_v2.sb

@@ -109,7 +109,7 @@
   (path "/dev/urandom"))
 
 (if (= os-version 1013)
-  (begin (allow file-read-data (subpath "/private/var/db/timezone"))
+  (begin (allow file-read* (subpath "/private/var/db/timezone"))
          (allow file-read-data (subpath "/usr/share/zoneinfo.default"))))
 
 (if (< os-version 1013)

services/service_manager/sandbox/mac/renderer.sb

@@ -37,7 +37,7 @@
 
 ; https://crbug.com/754280
 (if (param-true? macos-1013)
-  (begin (allow file-read-metadata (path "/private/var/db/timezone/zoneinfo"))
+  (begin (allow file-read* (subpath "/private/var/db/timezone"))
          (allow file-read-data (subpath "/usr/share/zoneinfo.default")))
   (allow file-read-data (subpath "/usr/share/zoneinfo")))